Microsoft Sentinel
The KQL Playbook (Play #2): Mastering the Matching Game
Alright, class. Welcome back to the KQL playbook.
In our last session, we covered the four core moves of KQL. You learned how to grab a table, filter
Author
Bartosz Wysocki
Head of security engineering at a UK MSSP. I started as a SOC analyst and never stopped writing KQL. These days I build the detections, automation and reporting behind a managed SOC on Sentinel and Defender. Profo does the drawings.
121 posts
Microsoft Sentinel
The KQL Playbook (Play #2): Mastering the Matching Game
Alright, class. Welcome back to the KQL playbook.
In our last session, we covered the four core moves of KQL. You learned how to grab a table, filter
Automation
The Self-Updating Watchlist: Automating Sentinel with Logic Apps & Graph API
Alright, class.
Let's talk about one of the most powerful tools in your Sentinel armoury: the Watchlist. It's how you teach Sentinel about your
Unlocking Sentinel's True Power: A Guide to the Graph API and Logic Apps
Alright, class.
You've built playbooks. You've used the built-in connectors to update incidents, post to Teams, and maybe even block an IP. You&
Microsoft Sentinel
Herding Cats with Sentinel: An In-Depth Guide to Workspace Manager
Alright, class.
In a previous lesson, we discussed the "Seven Deadly Sins" of a Sentinel deployment, and Sin #1 was "Workspace Sprawl." I told
The 7 Deadly Sins of a Microsoft Sentinel Deployment
Alright, class.
You've read the guides, you've watched the videos, and you've bravely deployed Microsoft Sentinel. You're feeling pretty good.
Microsoft Sentinel
Beyond the Basics: Forging Your Own Custom Detections in Defender XDR
Alright, class.
You've started to notice something. Sentinel is the brilliant general in the command tent, seeing the whole battlefield. The actual guards on the walls,
Microsoft Sentinel
Hunting Ransomware in Storage Accounts (When You Can't Afford Defender)
Alright, class.
Let's talk about the crown jewels of your Azure kingdom: your Storage Accounts. It's where you keep your critical application data, your
Microsoft Sentinel
The "Undo" Button for Sentinel Logs: An In-Depth Guide to Purging Data
Alright, class.
Let's talk about the "I have made a terrible, expensive mistake" moment.
You just onboarded a new data source. You thought you
Microsoft Sentinel
Sentinel's Built-in Consultant: An In-Depth Guide to SOC Optimization
Alright, class.
You've built your security operations center in Sentinel. The logs are flowing, the alerts are firing, and your team is bravely fighting the good
Microsoft Sentinel
Microsoft Threat Intelligence: Giving Your Sentinel a Brain
Alright, class.
Let's talk about the first question every SOC analyst asks when a new alert fires. You see an incident for a strange sign-in
Microsoft Sentinel
Sentinel's Endgame Gear: Sentinel Data Lake
Alright, class.
You’ve tamed your monthly Azure bill. You're filtering logs, using Basic tiers, and your CFO has stopped giving you the evil eye in
Microsoft Sentinel
Sentinel on a Budget: How to Tame Your Log Costs
Alright, class.
You've done it. You've deployed Sentinel, connected your data sources, written some slick analytic rules, and maybe even automated a few things.
Get the next post by email
One email per post, plus the KQL Vault. That's the whole deal.